MySQL and MariaDB: supported versions and safe upgrades

Updated November 2026

Update MySQL or MariaDB from the same source you installed it from, then make sure the server process has restarted on the new version. Minor updates are safe to apply in place. Major upgrades need a backup and a test first. As of November 3, 2026, MySQL 8.0 and MariaDB 10.6 no longer get community security fixes, so plan to move off them.

8.4.13 / 9.7.4MySQL LTS fixes, October 20, 2026
98MySQL patches in Oracle's October 2026 update
12.3.3Newest MariaDB LTS release, August 24, 2026

What they are

MySQL is the relational database developed by Oracle. MariaDB began as a fork of MySQL and is developed by the MariaDB Foundation together with MariaDB, the company behind mariadb.com. The two still share the client protocol and most SQL, but their versions, features and security fixes are now separate. Most PHP applications, such as WordPress, Magento and Drupal, and most hosting control panels run on one of them. A fix for one product does not tell you anything about the other, so check which one you have.

Check the installed version

mysql --version                        # client; on MariaDB it says "MariaDB"
sudo mariadbd --version                # MariaDB server (RHEL: /usr/libexec/mariadbd)
sudo mysqld --version                  # MySQL server (RHEL: /usr/libexec/mysqld)
mysql -u root -p -e 'SELECT VERSION();'   # version of the running server

On Debian and Ubuntu, sudo mysql often logs in as root without a password through the Unix socket. Then find out which package source supplied the server:

apt policy mariadb-server mysql-server      # Debian, Ubuntu
rpm -qa | grep -Ei '^(mariadb|mysql)'       # RHEL family, SUSE
pkg info | grep -Ei 'mariadb|mysql'         # FreeBSD

Supported versions

MariaDB releases one long-term support (LTS) series per year. Community binaries get 3 years from general availability (GA), then 2 more years of critical and security fixes as source code only. Series up to 11.4 get 5 years of binaries. Rolling releases (13.x) are updated quarterly and are replaced quickly.

MariaDB community support, as of November 2026
Series	GA	Community end of life
12.3 LTS	May 28, 2026	June 12, 2029
11.8 LTS	June 4, 2025	June 4, 2028
11.4 LTS	May 29, 2024	May 29, 2029
10.11 LTS	February 16, 2023	February 16, 2028
13.1 rolling	September 2026	Q1 2027
13.0 rolling	May 2026	Q4 2026
10.6 LTS	July 6, 2021	Ended July 6, 2026 (paid enterprise support to August 23, 2028)
10.5 and older	—	Ended

MariaDB's latest security batch came out on August 24, 2026: 12.3.3, 11.8.9, 11.4.13 and 10.11.19 (and 10.6.28). The CVEs it fixed were published in October 2026, and several are rated CVSS 9.9. If you run anything older than those versions, update now.

MySQL has two tracks. LTS releases get only necessary fixes, with 5 years of Premier and 3 years of Extended support. Innovation releases add features and are supported only until the next Innovation release. After 9.7, MySQL uses calendar version numbers (26.10 means October 2026).

MySQL support from Oracle's lifetime support policy, as of November 2026
Release	GA	Premier ends	Extended ends
9.7 LTS	April 2026	April 2031	April 2034
8.4 LTS	April 2024	April 2029	April 2032
26.10 Innovation	October 20, 2026	Next Innovation release	None
8.0	April 2018	April 2025	April 2026 (ended)
5.7	October 2015	October 2020	October 2023 (ended)

After Extended support ends, a release falls under Oracle's Sustaining Support, which includes no new fixes or Critical Patch Updates. Oracle publishes MySQL security fixes in its quarterly Critical Patch Update (CPU). The October 20, 2026 CPU had 98 new MySQL patches. 29 of them can be exploited over the network without logging in. It listed MySQL Server 8.4.0–8.4.12, 9.7.0–9.7.3 and 26.7.0–26.7.1 as affected. The fixed releases are 8.4.13 and 9.7.4. The next CPU is due on January 19, 2027.

Distro packages or vendor repository

Distributions pick one series and backport fixes, which means they copy the security patch into the version they shipped. As of November 2026, Debian 13 ships MariaDB 11.8, Debian 12 ships 10.11 and Ubuntu 26.04 ships MariaDB 11.8 and MySQL 8.4. Ubuntu 22.04 and 24.04 still ship MySQL 8.0, which Oracle no longer patches, so watch Ubuntu's security notices to see how Ubuntu handles it. On Ubuntu 22.04 and 24.04, MariaDB is in the universe component, which gets security fixes through Ubuntu Pro (ESM). See Ubuntu for what that covers.

If you need a newer series, use the vendor repository. Run MariaDB's mariadb_repo_setup script with a fixed series. If you leave out the series, the script uses the rolling release by default:

curl -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup
# compare with the checksum listed on mariadb.com before running it
chmod +x mariadb_repo_setup
sudo ./mariadb_repo_setup --mariadb-server-version="mariadb-11.8"

For MySQL, install Oracle's mysql-apt-config package (Debian, Ubuntu) or its Yum repository package, and choose an LTS series. The Oracle repository can replace Debian or Ubuntu's own MySQL packages, but not MariaDB. To switch from MariaDB to MySQL, you must back up your data and uninstall MariaDB first.

Update commands

# Debian, Ubuntu
sudo apt update
apt list --upgradable 2>/dev/null | grep -Ei 'mariadb|mysql'
sudo apt upgrade

# RHEL, Rocky, AlmaLinux, Oracle Linux
sudo dnf upgrade --refresh 'mariadb*'      # or 'mysql*'

# SUSE
sudo zypper refresh
sudo zypper update mariadb mariadb-client

# Alpine (as root)
apk -U upgrade mariadb mariadb-client

# FreeBSD (as root)
pkg upgrade mariadb118-server             # or mysql84-server

# Docker: pull the same series tag, then recreate the container
docker pull mariadb:11.8                  # or mysql:8.4
docker compose up -d

These commands stay within your current series. To move to a new major series (for example MariaDB 10.11 to 11.8, or MySQL 8.0 to 8.4), take a full backup and test the upgrade on a copy first. MySQL supports going from one LTS to the next LTS only, so 8.0 goes to 8.4 and then to 9.7.

Restart and finish the upgrade

A database restart briefly drops all connections. Pick a quiet moment, or switch traffic to a replica first.

sudo mysqld --validate-config                # MySQL only: checks my.cnf, exit 0 = OK
sudo systemctl restart mariadb               # restarts the service; MySQL: mysql or mysqld
sudo mariadb-upgrade                         # MariaDB on RPM systems, after a major upgrade

Oracle's APT packages always restart MySQL after an update. Debian and Ubuntu packages also run mariadb-upgrade automatically after a MariaDB major upgrade, but on RPM-based systems you must run it yourself. MySQL 8.0.16 and later upgrade their system tables by themselves at startup, so they need no extra command. On Alpine, restart with rc-service mariadb restart. On FreeBSD, run service mysql-server restart (the service has this name for both MySQL and MariaDB).

Verify

mysql -u root -p -e 'SELECT VERSION(); SHOW GLOBAL STATUS LIKE "Uptime";'
sudo journalctl -u mariadb --since today | tail -n 20    # or -u mysql / mysqld

The version should match the fixed release, and the uptime should be short. Then test a login from your application.

Keep port 3306 off the internet

Bots scan the internet for open database ports all day. When they find a server with a weak or empty password, they often copy or delete the databases and leave a table with a ransom note. Patching does not protect a database that anyone can log in to. MySQL listens on every interface by default (bind_address = *). Many MariaDB packages bind to 127.0.0.1, but don't assume yours does. Check what is listening:

sudo ss -tlnp | grep -E ':3306\b'

If the address shown is 0.0.0.0 or * and the application runs on the same host, set bind-address = 127.0.0.1 in the [mysqld] section and restart. If other servers must connect, bind to the private address and allow only those hosts in the firewall (see firewall basics). If you were already hit, follow database recovery and data breach steps.

Where advisories appear

Oracle Critical Patch Updates and Security Alerts: MySQL fixes come in each quarterly CPU. The page explains how to get email notifications.
MariaDB Community Server CVE list: every CVE with the fixed version in each series.
Release notes: MariaDB and MySQL.
Your distribution's security tracker for backported fixes, and our vulnerability pages.

Quick hardening tips

Bind to 127.0.0.1 or a private address, and firewall port 3306 from everything else.
Test from another machine with nc -zv your-server 3306. A refused or timed-out connection is what you want.
Check that mysql -u root without a password fails over the network. Remove anonymous accounts and the test database.
Give each application its own user with rights to its own database only. Never grant access from '%' (any host) if you can name the hosts.
Require TLS for any connection that leaves the host.
Keep automated, off-server backups and test a restore. See backups.
Pin your repository to an LTS series so a routine update cannot jump you to a new major version.